Color-team review
Umbra · 8sysa3XPrvKPmUA4qoZCn9h4vp7Mb45Ynezg542nui8Q · trader EJGW…Uvaxs · failed
Coverage: forensics yes · market yes · snapshot yes. Confidence: high. Availability: available. Snapshot freshness: 31 July 2026 (18d, stale).
Ask size is independent of attack-vector indicators. Flip-cost dollars appear only when already published.
Roster readout
Six bounded teams, one shared evidence layer. Each finding stays in its lane; there is no composite score, and withheld lanes stay withheld.
Forensics, market, and snapshot present · confidence high · snapshot stale.
Recycled-stake treasury extraction: HIGH-RISK — 5/5 indicators; Late-window TWAP outcome steering: withheld (UNSCORED); Wash-volume alignment inflation: withheld (UNSCORED); Coordinated multi-wallet stake assembly: withheld (UNSCORED). Each finding stays on its own vector ([email protected], [email protected], [email protected], [email protected]).
Volume ~46% pass-aligned / ~54% fail-aligned. Market outcome and forensic match stay separate.
Ran [email protected]. Withheld [email protected], [email protected], [email protected] — evidence incomplete, so those detectors did not run. Each classification stays scoped to its own evidence packet.
Umbra's Decision Market Rejected a $1.5M Treasury Attack — 01Resolved, 5 August 2026. The mechanism became a versioned playbook; the case stays a cited replay.
Indicators are never added across vectors; market outcome and forensic match stay separate.
Pass / fail market math
Pass-market TWAP versus fail-market TWAP against the pass threshold decides whether the proposal passed or failed.
-16.55% against +3.00% threshold · published spread -16.56%
-0.0800 · ~46% pass-aligned / ~54% fail-aligned
Economic attack indicators
Each classification is scoped to one monitored vector. Indicators are never added across vectors. A no-match is not a LOW or safe assessment.
Recycled-stake treasury extraction · [email protected] · Economic governance attack
A proposer acquires the required stake, rapidly recovers and reuses it in the decision market, with wallet-funding and execution behavior providing supporting evidence.
This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.
Published case: Umbra · 01Resolved, 5 August 2026.
| Match | Indicator | Evidence |
|---|---|---|
| MATCH | Fresh wallet with no prior history | first seen 4d before proposal; prior history=false |
| MATCH | Cross-chain / bridge funding | deBridge from base; $148,930 |
| MATCH | Accumulation trimmed to exact proposal-stake threshold | bought 509,000, sold 8,690, final 500,000 vs required 500,000 |
| MATCH | Stake recovered and reused in the decision market | recovered seconds later (exact latency unpublished); reusedInDecisionMarket=true |
| MATCH | Clustered fixed-size cadence trades | 40 × $100 trades, published as roughly 60s apart |
Late-window TWAP outcome steering · [email protected] · Decision-market manipulation
A trader waits out most of the TWAP window, then pushes a marginal print across its threshold in the closing stretch — when the required move is fully known and defenders have the least accrual time left to trade the price back. Late trades carry the least time-weight, so the target is a market already near its threshold, not the TWAP itself. Late activity also has benign forms — organic close-out and activist pressure — so a detector must separate steering from ordinary end-of-window trading.
This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.
Economic attack indicators are unavailable. Vector classification is withheld.
Wash-volume alignment inflation · [email protected] · Decision-market manipulation
Automated near-neutral flow inflates a market's apparent volume and economic alignment, dressing thin conviction up as broad support while contributing no real position either way. The same fingerprint matches benign arbitrage flow, which published analysis strips as routine; a detector must separate deliberate wash from ordinary arb before it can say anything.
This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.
Economic attack indicators are unavailable. Vector classification is withheld.
Coordinated multi-wallet stake assembly · [email protected] · Economic governance attack
An operator splits stake acquisition or market activity across coordinated wallets so no single address crosses the eligibility thresholds the protocol enforces or the attribution thresholds a reviewer watches. Coordination alone is not an attack — multi-wallet holders and coordinated defenders share parts of this shape — so the mechanism is the threshold evasion, not the wallet count.
This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.
Economic attack indicators are unavailable. Vector classification is withheld.
Mechanism hardening (illustrative)
A pass threshold that rises with treasury share (+3.00% + 20pp × 62%) = +15.40%.
The attacker’s intra-window spike printed +12.47%. Against the scaled threshold it would not have cleared.
Sources: James & Drew, 01Resolved, 5 August 2026; 01Resolved, Ownership Coin Monthly, July 2026, as of 31 July 2026.